Qualcomm Fixes 3 Zero-Days Used in Targeted Android Attacks via Adreno GPU

CVE-2023-33106 is a memory-corruption flaw (use of out-of-range pointer offset, CWE-823/CWE-119) in Qualcomm's KGSL GPU kernel driver, which manages the Adreno graphics stack. It is triggered when a local, low-privileged process submits an AUX command containing a large list of sync points through the IOCTL_KGSL_GPU_AUX_COMMAND ioctl, causing out-of-bounds memory access. A successful attacker, typically a malicious app already running on the device, can corrupt kernel memory and escalate privileges, gaining the high confidentiality, integrity and availability impact reflected in its CVSS 7.8 local-attack score. Affected products include the listed Qualcomm components (FastConnect 6200/6700/6800/6900/7800, QAM8255P/QAM8295P/QAM8650P, Flight RB5 5G Platform, AR8035, CSRA6620/CSRA6640), and the vendor's advisory describes the flaw as spanning multiple chipsets. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-12-05, and public reporting indicates it was one of three Qualcomm zero-days actively exploited in targeted Android attacks alongside Adreno GPU issues; no public PoC is known.

Do: Install Android security updates or firmware from your device/OEM vendor that incorporate Qualcomm's fixes for this CVE, prioritizing devices and systems built on the listed chipsets, and check the Qualcomm security bulletin for the fixed firmware versions for each component. Because exploitation requires local code execution, avoid installing untrusted apps on unpatched devices as an interim mitigation. Organizations subject to BOD 22-01 must apply the vendor remediations per the KEV required action.

CVE-2024-43047 is a use-after-free vulnerability (CWE-416) in the firmware of several Qualcomm connectivity chipsets and the QAM8295P automotive SoC, where maintaining memory maps of high-level operating system (HLOS) memory causes memory corruption. The flaw is scored with a local attack vector and low privileges required (CVSS 3.1: 7.8), so an attacker needs some local foothold, such as a malicious app on an Android device, and can then leverage the memory corruption for high-impact confidentiality, integrity, and availability effects, in practice a privilege escalation to system or kernel level. Anyone running devices built on the affected chips is exposed, including Android smartphones with FastConnect 6700/6800/6900/7800, devices using QCA-series Wi-Fi chips, and automotive platforms using the QAM8295P. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-08, and news reports describe targeted, limited Android attacks, though ransomware use is unknown and EPSS remains modest at 0.7%.

Do: Apply Qualcomm's fix through your device or system OEM: install the latest Android security updates on affected phones, and update firmware/drivers for QCA-series Wi-Fi chips and the QAM8295P automotive SoC per vendor instructions; because this is a local firmware flaw, there is no user-side mitigation short of patching. Organizations under CISA KEV must remediate per the required action (apply vendor remediations or discontinue use). Prioritize an inventory of Android devices with FastConnect 6700/6800/6900/7800 and QCA6xxx/65xxx chips, noting this flaw is being used in targeted attacks rather than mass-scale campaigns.

CVE-2025-21479 is an incorrect authorization flaw (CWE-863) in Qualcomm chipset firmware that allows unauthorized command execution in a GPU micronode, causing memory corruption when the GPU processes a specific sequence of commands. Because the CVSS vector is local (AV:L) with user interaction required, exploitation most plausibly involves a malicious local application or process driving the GPU through the vulnerable command sequence. An attacker who successfully triggers the flaw gains high-impact confidentiality, integrity, and availability effects with scope change, meaning the compromise can extend beyond the GPU component to the broader device. Affected products span Qualcomm AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, Snapdragon 855 (SD855), SM4635, and SM6250 firmware, i.e., chipsets used in Android smartphones and IoT/industrial devices. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-06-03, and news reports describe limited, targeted Android attacks exploiting Qualcomm GPU zero-days fixed in Google's 2025 Android security updates.

Do: Apply Qualcomm's fix by installing the Android security update from June 2025 or later (or the OEM/vendor firmware update for QCM4490, QCS4490, FastConnect, and other affected chipsets), checking your device's security patch level and chipset firmware against Qualcomm's bulletin, which lists the exact fixed versions. Organizations subject to BOD 22-01 must apply vendor mitigations per CISA's KEV required action or discontinue use of affected products; there is no known public PoC, but exploitation in targeted attacks is confirmed, so prioritize patching internet-facing and user-facing Android fleets.